From 6e8c9ac24b21f332399245ffe32a713484f9493c Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Wed, 15 Apr 2015 10:46:41 -0700
Subject: [PATCH] Bug 1154480 - Make new Uint8Array().set([], -1) throw a
 RangeError, not merely an Error.  r=till

--HG--
extra : rebase_source : eec24e20cd07152378098dc8f5bc21ed804f64e5
---
 js/src/js.msg                                 |  4 +--
 .../ecma_6/TypedArray/set-negative-offset.js  | 35 +++++++++++++++++++
 js/src/vm/TypedArrayCommon.h                  |  3 +-
 3 files changed, 38 insertions(+), 4 deletions(-)
 create mode 100644 js/src/tests/ecma_6/TypedArray/set-negative-offset.js

diff --git a/js/src/js.msg b/js/src/js.msg
index 39227e3a2b70..0b2f190556d6 100644
--- a/js/src/js.msg
+++ b/js/src/js.msg
@@ -455,8 +455,8 @@ MSG_DEF(JSMSG_TYPEDOBJECT_TOO_BIG,     0, JSEXN_ERR, "Type is too large to alloc
 MSG_DEF(JSMSG_BAD_INDEX,               0, JSEXN_RANGEERR, "invalid or out-of-range index")
 MSG_DEF(JSMSG_TYPED_ARRAY_BAD_ARGS,    0, JSEXN_TYPEERR, "invalid arguments")
 MSG_DEF(JSMSG_TYPED_ARRAY_BAD_OBJECT,  0, JSEXN_TYPEERR, "invalid object argument")
-MSG_DEF(JSMSG_TYPED_ARRAY_BAD_INDEX,   0, JSEXN_ERR, "invalid or out-of-range index")
-MSG_DEF(JSMSG_TYPED_ARRAY_NEGATIVE_ARG,1, JSEXN_ERR, "argument {0} must be >= 0")
+MSG_DEF(JSMSG_TYPED_ARRAY_BAD_INDEX,   0, JSEXN_RANGEERR, "invalid or out-of-range index")
+MSG_DEF(JSMSG_TYPED_ARRAY_NEGATIVE_ARG,1, JSEXN_RANGEERR, "argument {0} must be >= 0")
 MSG_DEF(JSMSG_TYPED_ARRAY_DETACHED,    0, JSEXN_TYPEERR, "attempting to access detached ArrayBuffer")
 
 // Shared array buffer
diff --git a/js/src/tests/ecma_6/TypedArray/set-negative-offset.js b/js/src/tests/ecma_6/TypedArray/set-negative-offset.js
new file mode 100644
index 000000000000..6d9c45ffb2c6
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedArray/set-negative-offset.js
@@ -0,0 +1,35 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+var gTestfile = "set-negative-offset.js";
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 1140752;
+var summary =
+  "%TypedArray%.prototype.set must throw a RangeError when passed a negative " +
+  "offset";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+try
+{
+  new Uint8Array().set([], -1);
+  throw new Error("didn't throw at all");
+}
+catch (e)
+{
+  assertEq(e instanceof RangeError, true,
+           "expected RangeError, instead got: " + e);
+}
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");
diff --git a/js/src/vm/TypedArrayCommon.h b/js/src/vm/TypedArrayCommon.h
index a5857290ccdc..3bfb1c7fa064 100644
--- a/js/src/vm/TypedArrayCommon.h
+++ b/js/src/vm/TypedArrayCommon.h
@@ -686,8 +686,7 @@ class TypedArrayMethods
 
             if (offset < 0 || uint32_t(offset) > target->length()) {
                 // the given offset is bogus
-                JS_ReportErrorNumber(cx, GetErrorMessage, nullptr,
-                                     JSMSG_TYPED_ARRAY_BAD_INDEX, "2");
+                JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_BAD_INDEX);
                 return false;
             }
         }